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(57) [ffifo] 

ilfqSMnXfyy (3 0 5) t, 31R©^if 
iSitfgi&tBEtSXfyy (3 2 5) Ls F sub 
Qv Tttt)"^. f (mod q) OjSSBc^£3fe)S^"SX 
y^v^t. F sub p. f fcib't f (mod p) 
©5£afc£££rr*>X5^7 O4 0) <h> g*5«fctfF 
sub q*<e«bTlSm-rsrt©T#-5«t, qS- 

(3 5 0) t, fi5«ktfF sub p £i*ait* C t 
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r 31S 
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h s Fq*g (mod q) 
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FIG. 3 



(2) OO 0-5 1 6 7 3 3 (P 2 OOO- 5 1 6 7 3 3 A) 

1 . • * yt-^m^bL^tS^T^oT, 

*RO>g^ f *3«fct*g£r£j£U f (mod q) ©ffTfc5I*F q ^ 
fife U f (mod p) ©fttfc5IiF p ^f§77-7/t, 

5. mm%jkf&-rz>mm*"ry-7&is g (mod q ) <d& 
wzxhzwmG^tkm^^ g ( m od P ) <DmmT~&z>mmG I ,%:±f%-fz ) * 

g^gi(i=l, 2.....K) S:^, gflB^BBtlhdShi (i =1, 2.....K 
8. fulfil 2)W f'T^p^i:^ (i=i, 2.....K) Btj 



1 

(3) SS2000-5 1 6733 (P 2 OO 0-5 1 6 7 3 3 A) 

K. 

e = j * h , + m (mod q) 

i i. n^-ik* y±—i?j)K ^t-^mi, 0*3 i^h^-^tpfl 

i3. Btiia^F^b^ sx-fe— $>5^~- ifiiioTfcsii^f-e^^tb, Wis 
5 »3f a> e>su (omwrKfem £ mtim^mm-c fc<5^— if i-i origin 
z^t *mwLk -t&m^mmw, 1 «^tE«^& 0 

F q *f = 1 (mod q ) 
F p ~ f = 1 (m o d p ) 

-?%>Z>* s ryZfk. 

P, q, h^tP^gl^Sr^-rS^Xs/^TfcoT, 

h = F a * g (m o d q ) 



(4) 882000-5 1 6 733 (P2 OOO- 5 1 6 7 3 3A) 

15. mifB^^b^ ^ir-^e 

e = p 0*h+m (mod q) 

16. BUffi^^-^ y-fe — i?AS, 

a = f * e (m o d q ) 

m' =F p *a (mod p) 
©#*SgSrgi, g 2> ... , gut tT^fS^Tj/T 0 ^^ flfr1E4*0H«#s h 

i, h 2) ..., hic^T'B'^-x 

h i EF «*gi (mod q) „ i = 1 , 2.....K 
18. Mffi^^b^ ^\ 

e = p <j> ,*h !+ p ^ 2 *h 2 + . . . + p 0 K *h K +m (mod q) 
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(5) K82000-51 6733 (P 2 OO 0-5 1 6 7 3 3 A) 

2 0. =z-y9&sf&M (x) tfmmzti. ^m^.(ommK ^-r^m^mm 
mm £ ^5 r t i: -r 5tt*©«ss^ 1 4 gt(- isfi<w?£ 0 

5 £ £ «t o THi£ $ *l5 r i £ "T 511 *<£>$£'ffl^ 1 4 ^(Cfsm^^feo 

2 2. it&iE^JSsU, g% m, *2SW#«»:«:fco.fc 5 J-fM&l £ *l 3 r k*&m 

2 3. HufESf^q^ SulE^ik p £ , milE^^^f % g, m N x jtfrfe 

2 4. HulSS^q^, MfE^pi, milE^sCf, g, nu SulE 
f % g, rru *^»{i^5^fll!l»^^±oT**S*«fc«9 t>^:#<5BH!tb 
5- £&4#i»£i-5f&#<z>3&ia^2 2^ 

2 5. ^^/U. ^ 3't-mffkL«ftS^-efeoT 1 

It#f?rtL, Wi=0 (mod p) (i=l, 2, . . . , K)T«2bZ>?f$\](Dm. 

fabK+ 2m(Dft?\\ f , g, gl , w WK^fS^fyri, 

BtflBfT^JO^d^j^tT^JF^ P Q , G„, C^tS^ry/TfeoT, 

f F p = I (m o d p ) 

f F q = I (m o d q ) 

g G p = I (mod p ) 

gG q = ] (mod q) 

4*M«£:Kfi©fT?r| (h lf h 2 , . . . , h0 o <J x h k LT^tS^r y 
h i= F^iG, (m o d q), i=l, 2,...,K; 



J ' > • 

(6) S82000-51 6733 (P2 000-5 1 6 7 3 3 A) 

mmm&nw u, g, f p , gj iu^ts^f s/^, 

e = 0 ! h i+ <f> 2 h 2 + . - . + 0 K h K +m (mod q) ; 
a = f e g (mod q) 

b = a (m o d p ) 

m' = F p b G p (m o d p ) 

3 bsij^mBTi-^ $ *u mm%\cDmm-?:tbz> ^— tf ^ «t o tit $ 

2 7. MIStT^Jw,, w 2 ,...,w K , f, g, mfi^W&M&-b^J:ylzmm£th 

2 8. mtmmqdK mmmmpt, mmmmKt, mm^m^™,, W2 ,..., 

w K , f, g, mCO&l^ct, HLflE^JSsCw!, w 2 w K , f, g, m<D^fM^ 

2 9. itulEMkq^\ iiufMfcp^ iiuf2M&:K£ s Utiffi^I^w,, w 2; ..., 
w K , f, g, rmDYkWut, fijffi^JS^W!, w 2 ,...,w K , f, g, mCO&Ml^ 

n-r^mmmmt, mm**, <t>*,..., <t>K^M-r^mmpmt^x<>x^^m 



(7) 1**2 000-5 1 6 7 3 3 ( P 2 0 0 0 - 5 1 6 7 3 3 A ) 

3 0. • * yt-ym^fjblI^t5^7At&ot, 

iRoiif^it/g^u f (mod q) <DmkT'foz>mm? 

fifcU f (mod p) ©»$)5SiF p «t5^h 

g *3j:7j?F Q ^ffiLT#5^^<z)-e#?,?Si:mo d q -e£-|5 J -c&5 h 

31. Buta^^b^ ^ir-v 5 ?)^ hz>^-— -if^x^xh&mm^f&zti, tuts 

M&b*£.&-tZ>xTv7b, 

R*<7»&< ^ & 2 oc^ifffflii^i f x,..., f ©a- !f<7MxT 
^7-^h 

&R£, JfT^Qtbs JT'T/^Pb, R<p(ommh hub(Dm^m 
l (D ^—*ffabm2(D^-iflcfcm-tZ>*'ry-^b, 

4 s rT/i'P&£X$Qb. / £MMmmhi,...,hub, Rf©fffl^ y-fe— 

irah |2tf)i- W'pftK bi> 10(7)fffl7>Aii^ 0itc7>p 

3££ LTlR^^ie^tS^fs//^ 
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(8) 8S20O0-5 1 6 7 33 (P2 OO 0-5 1 6 7 3 3 A) 

e, f ...... f~(DmmFzmmi-z>R<p<D&%:AZftnu r&tm&mc 0 <D 

M^CDACDiXmm^a^mU a, f...-.,f„©H*G«rff«i-5»J|l 
3 3. ^ ^-o^^^ mj&SC P (Z>S&T&5 £^ - £ 3,^ 

mdri-§lt^(DtEffl^3 2^{d|E«^^r& 0 

34. a, b, c, f f„©H««rtt*i-5££fcJ:o-c, ft 1 ©a— if 
3 5. i^ilih 1( ..., h k 3^ 1 £ k<^tf># i ic:ov^I?irf 1 ;^M'7='T/^ 
3 7. 117^51*1 0i^f7^p^i^5 : t&mmt-t&m 

3 9. e, f lf ..., f»©B8*F«rW«-r5«l*A^ae f^fcS^^S 
40. a, f f -©BBftGSrffMi-rstejltB^K^aTfcS^tSrftfti: 

4 1. a, f f "©itHHfttt^ilMCCpM^^ 



(9) ft&2 0 0 0-5 1 6 7 3 3 (P 2 O O 0-5 1 6 7 3 3 A) 

4 3. iR^\ HkWnN(D^e=-^^^m^:M (X) CJ:ot4^^SR^f7 

3 2m^mm<Djj& 0 

^^sm 0 1, . . . , 0 x^> ^(omm^tt-rsnR*^ ttt v^ 5 ^^/c-t-^ t 

o 

4 6. gihi h,c7)^ 1 tKOFI©#i tOV^Tlif k+ ihif k+2 ^f 

4 7. ^hbmjs f f *&j^7/i'P^iz&zzb%<&mb-rz>m$:(D%B. 
mm 3 2m^mm(D^m 0 

4 8. Iffi^^S**! 0 2^,7)^ Si^i <.JMt7^P*(I 

h z> t v ^ o ^i^mtc-r zb&ftmt -r^n^mmm 3 2 ^(cie«o^i£ 0 

4 9. ^iillih!,..., h k t, #ffl7^y^5l*0i,..., <t> z ^b, Hffl^ 
h 1 0 k+i 4- 0 2 h 2 0 k+2 + , . . . , + 0 k h k 0 2k+ 0 2k+i + m i -q l«]Tfo<b C 0 69ll 
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(10) 8S2000-5 1 6733 ( P 2 O O O - 5 1 6 7 3 3 A ) 

5 2 . W7^AH| 0 x, . . . , 0 ^\ H*0 0 ^JJMft^joX&ftftT 

I©@SLfcM^©it^t5R«©iA Tfc5: ^ rttt5at 

54. vjemf, f n> mm*<sr±-&Mm ms ts^xmm^^y^ 

m <t> x, .... 0 ^^t^^s^^^ ^ v ^ *M*£stfc?-£ ^ 

55. ^R2S % -®H#X N =1 % Y 2 =l s XY^YX^IIf^^lft^ 
qiaoT^$tl§^f'7/K^^ R©^f7^P«p|ij;oT^$ 
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(11) RS2000-51 6 733 ( P 2 O O O - 5 1 6 7 3 3 A ) 

5 6. *ffl«S5Hf 1,..., f ^S*m x fcJ:V$ffl7y^g 
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(12) 8S2000-5 1 6733 (P2 O O O- 5 1 6 7 33 A) 

*m«rau 1 9 9 6^8^1 9fummztiit*miRtG¥Fmmm6o/o 2 a 

o 

Att^»icis;j£-c^5 % *^*«lc^-c&5}8S % 2o©SIW^||H: 

^ l i-mr* & b * ^ £ ^ 5 ^ ^ & ^r-r 5 0 

o 
o 



(13) ft&2 0 00- 5 1 6 7 3 3 ( P 2 O O O - 5 1 6 7 3 3 A ) 

P q &&k^zmmm&wi£'*z<D&mm-e*>zzk\zm^< 0 m 1 «©i 

^r^itfit-^ v-^- 7=" i» Sr-ffrfci" 5 & ^Ifeffl £ tire i ^ I? 5 offi^Ojg i: LFB8 
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04) 8S2O0O-5 1 6733 (P 2 OO 0-5 1 6 73 3 A) 

<Z>#lte4 0 0 0 0 0 t> ha*©*#4«»fTMT*>5 0 i*btt*»»©*5ffl55. 

trv^v> 0 



/ 

) I 

■ 1 • * 

(15) S82O00-5 1 6 733 ( P 2 O O O - 5 1 6 7 3 3 A) 

f (mod q) £r£j3cU f (mod p) CO 

LT^ yir — ^m&#^t1-5££fcL«fcoTffi^fbp* v>e £^£rici-5*T- 

S':7 D £, *M!*«rftJB LTffiF-iHb* y-fe-i? e Srtttt 5 ^ 1 1 i-o T«f^ 5/ 

121 1 fl *Hffi©»I^Hlt§^mt5 r i ©T't 5^Ti»©7" 
JKIKli.J:SjSfEtbBITft)5o 

0 6ii, ^M^iWffl^sr^figi-s, *&m<Dfov>nmtemtz£z>;\,-3- 



(16) ftS 2000-516733 (P2000-516733A) 



tVO^. t^fAl 0 1 om,'t^fAi 5 5 

K^u-trD-l 6 0Sr^tf o /Dtyfi i o*3«tTjti.6 0 i:*tbJJii8igi-s|Di 

»SJli:5. ^tytfifcittf, Intel Pentiumynt.tf 
«fcV\, t^7fAl 0 5ttil^ ^H23^n.^.^ 5 >^0SS 1 
2 1, AtB^fgllS, ^-^12 5^ ^bttt^T^^I(7)ii© 

igfttt h 7 y->-/^ 13 5H LTfTfcJv h 7 yy-^' 1 3 5 te N ^7=^ £ 

^O^/^Hiot/y^fAl 5 5tt, ^fAi 0 5t» 
^^yi68, ^ . 5>^|5IKl 7 3, = * 1 7 6^t5, A^J 



(17) 2000-51 6733 (P2000-516733A) 

litter — tff—Kl 5 5iSt*n5. t^7Al 5 5 ir « £ <?iHf fi h 7 > 

^^g^cDR^v^^-Mi, M. Blumf^ TAn Efficient Probabilistic Public 
-Key Encryption Scheme Which Hides All Partial InformationJ (Advances in 

Cryptology: Proceedings of CRYPTO 84, Lecture Notes in Computer Science, 
% \ 9 6|, Springer-Vcrlag, 1 9 8 5f, 2 8 9^— ^V>t2 9 9^— v?) 
doiTJ^s. Goldwasserftil^f TProbabilistic EncryptionJ J. Computer and System 
s 

Science 28(1 9 8 2 7 0^/£^L2 9 9^-^) \ZMM^fzM^ 

S^iKiO (N 2 ) fli|-Cfe«9, Lfc^oT, RSAT»Mi$ti5 0 (N 3 ) #1 
<Z)f|Ca: «fc 9 t>d»/«C <5 B55£-?fc5 0 UttO (N) R. J. McEliecelf U Pu 

blic-Key Cryptosystem Based On Algebraic Coding ThcoryJ (JPL Pasadena, DS 



(18) ^$2000-5 1 6733 < P 2 O O O - 5 1 6 7 3 3 A ) 

N Progress Reports 42-44(1 9 7 8 N 11 1 6^— is) & 

£m. Goldreich^^ TPublic-Key Cryptosystems From Lattice Reduction Pr 
oblemsj (MIT-Laboratory for Computer Science^KSs 1 9 9 6^1 1 M ) 1.112 

mtstLtc£??m<D r^igj ^«^fi,-e*ii$ti5o (n 2 ) m&tm 
m-tz> 0 

*mW<Dm^r^*^J±(D^Mmnte. 4 0©l|/^-^ (N, K, p, q 
) ^ lS#tlrft/,N-1^^03o(7)ML Ql L n ti^#t 
So ^©^It^ffitt, mR = Z [X] / (X N -1) HF£R|i|]| 

F=| Fi x N - i = [F,, F 2 ,...,F N ) 

£r<fe-Cte&V\, Mtmc, -fifi© ([[ ]]) rt©Tf'j7/^LT, ^E©& 

a a x N - 1 +a 2 x N - 2 + ... + a N _ lX + a N 



(19) 4**2000-516 73 3 ( P 2 0 0 0 - 5 1 6 7 3 3 A ) 

[ a i, a 2 , • • • , a N ] 

*#vm§£\ rnn-r zx^yzfj)^ fax* fete < n i o gNmu&x~foz>m&-7 

*.f£, N= 5 i L, 2o(Z>^W*#3S5*:Srffiv^4&^ N MfPSIIt^T^SfcS: 

(x 4 +2x 2 -3x+2) - (2x 4 +3x 3 +5x-l) 

=2x 8 +3x 7 +4x 6 +5x 5 -6x 4 +16x 3 -17x 2 +13x-2 
=2x 3 +3x 2 +4x+5x-6x 4 +16x 3 -17x 2 +13x-2 
= -6x 4 +18x 3 -14x 2 +17x+3 

[[^^^^^AfiTc^XLf^, N= 1 6 7£fcteN=2 6 3 Srffiffli~S r. b 

#5]] cr<7)«Mtt, x N - 1 ©i-^Tof&afed^^s^-rr^Srfet-ts 

ffli-5^^^T$S 0 j:t>V-7 =r T7V(D#ga( l loV^-Ctt, 7ci I.N.Hers 

tein^TTopics in AlgebraJ £r#RBi~5 £ £ 5 D 

asSEffiSftSo W^qttL, «afe«r*r<z>*!lsfc-CB# 

M5r^fftt5 0 1tk%.&. q = l 28T^>5, fc5W2 3 7 7t|) 
54§£\ 2 3 7 7^128 tit?. ^ 1 8 -Cfc ^ 7 3 T'fc 5 OT\ 

/2^v>LqT&5i^fiW^ q i>mtbtiZ>zb&M&1r?i 0 Lfc^ot 

, q = 12 8l:f»»t5l^ - 5 5 = 7 3 - 1 2 8T*fc5©t'23 
7 7ii-5 5 1?a#^^ b^So 

mod qj i:*l:ftfflt5o 2o©#^SC©SPp^itSr 5 %mblTZ> 



(20) 882000-51 6733 (P 2 OOO- 5 1 6 7 3 3 A) 

(x 4 +2x 2 -3x+2)*(2x 4 +3x 3 +5x-l)=-6x 4 +18x 3 -14x 2 +17x+3 
= -x 4 -2x 3 + x 2 + 2x-2 (mod5) 

£?m&m^T) ^mm^i/xT j**rE&-tz>m, 

N=5 N K=1 N p = 3, q = 1 2 8 
[[^^->^X^«7t<!rx.tt\ N=16 7, K=6 N p = 3, q = 2 16 = 6 5 

L m = 3 t^V^ L 3 

*tt5)]]„ 

2x 4 -x 3 +x-2tt*^ L e (C#£ L , 



(21) K82000-5 1 6733 (P2000— 516733A) 

f *5«fc I* g Cl^)jgSWHb$tL^JT*ttK=l-C*>«5, Uc^otlo 

f = x 4 -x 3 +2x 2 -2x+l 
g=x 4 -x 3 + x 2 -2x+2 

[[Si4^fAttfcittf, K+HBa>#3g5£f , gl gK 6L^K = 

F q ~f=l(mod q)*5«tU« F„*f = 1 (mod p) 

£3o 1tk*.t£* *Wmm(DttMi I Sr#Rg-T5- £3&s-?#5 0 (v»<od»0Df 
^ia»*SrW$*V^^*Sfc5 0 DanlJ«I^ B'J<£> f 

5 0 ) JLIE<Z)#iJ f -Cfi N &&.&filfrtZ> e 

F Q = 103x 4 +29x 3 +l 16x 2 +79x+58 

F p =2x 4 +2x 

-So 

F a *f=(103x 4 +29x 3 +116x 2 +79x+58)*(x 4 -x 3 +2x 2 -2x+l) 
= 256x 4 +256x-127 

= 1 (mod 128) 

F^f = (2x 4 +2x) *(x 4 -x 3 +2x 2 -2x+l) 
= 6x 3 -6x 2 +6x-2 
= 1 (mod3) 



(22) ^52000-5 1 6733 (P2 000-5 1 6 7 3 3 A) 

h = F„* g (mod q) 

t5cim§o ]■] 

hi^F^gidnod q), i = l,2,...,K, K = 6 

F q *g=(l03x 4 +29x 3 +116x 2 +79x+58)*(x 4 -x 3 +x 2 -2x+2) 
= 243x 4 -50x 3 +58x 2 +232x-98 
= -13x 4 -50x 3 +58x 2 -24x+30 (raodl28) 
Dan (D£:mm&SlT(D2>m : &T*foZ> 0 

h=-13x 4 -50x 3 +58x 2 -24x + 30 
Dan©fffli«#TO (f, F p ) Tfc5 0 jgCaUftl^ F„tt»fcf^b^» 

a thyiSDa n©^lHhOTLTDa n yir — v^i^lf i~5^S*S*> 

s^is^rso ca t h y tt«rtBfc* yt-e;©*^L>t,i>5^ .^-^ 

C a t h 

m=x 4 -x 3 +x 2 +l 

^^rii^-rso ca t h y nfr&.&m$iirz> 0 

<t> =-x 4 +x 3 -x 2 +l 

Cathytt, m^^mtRl^t'^Ol^m^Q, Da ncD^^ith (ftbXfiZp 
&£TJq s i-3iC*3*> % 4*BI&<Z5 — gtfh Ca t h y (T)^^ 5/* — ^Srftffl U 

e = p © *h+m (mod q) 



(23) 45*2000-5 1 6 7 3 3 (P2000-516733A) 

2 *h 2 +...+p0 K *hK+m(mod q)^lt^-T5^ tCict^b^ yir — $rffr& 
tSrH^ttSo ]] BUife^LT, h7)S P F q -g(mod q) t^L< ^^m-^ 
% ^5te= <2>~h+m(mod q) ^^ffi L T * y± — it&ft&it-t 5 £ £ *S"C# -5 0 £. CO 

ww*. ca t h y teuTmm%n?o 

p</>*h+m=3(-x 4 +x 3 -x 2 +l)*(-13x 4 -50x 3 +58x 2 -24x+30) 

+(x 4 -x 3 +x 2 +l) 

= -374x 4 +50x s +196x 2 -357x+487 
= 10x 4 +50x 3 -60x 2 +27x-25 (modl28) 

LWoT, Ca t h y (Dft^ik* yir— i?t&&>T<0&*5&-efo*) . 

e = 1 Ox 4 +50x 3 -60x 2 +27x-25 
Ca t h yttroff^b^ i't-^Da n Cl^ff 5 0 

a = f*e(mod q) 
^ffl^^Jt?^ D a nftmT£>ft^£rfT9 0 

f*e= (x 4 -x 3 +2x 2 -2x+l) * (10x 4 +50x 3 -60x 2 +27x-25) 
= -262x 4 +259x 3 -124x 2 -13x+142 
= -6x 4 +3x 3 +4x 2 -13x+14(modl28) 

a= -6x 4 +3x 3 +4x 2 -13x+14 
Fp*a(mod p) 



(24) 8S2000-51 6733 (P2 OO 0-5 1 6 7 3 3 A) 

F p *a= (2x 4 +2x) *(-6x 4 +3x 3 +4x 2 -13x+14) 
= 34x 4 -4x 3 -20x 2 +36x-38 
= x 4 -x 3 +x 2 +l(mod3) 

*mw<Di&(DmMmm-e^ mteftm<n&-?&z> 0 tittup m r= mm 

? a n a 13 -•■ a 1M -y 

, a MJ a M2 a MMy 

~<£>4§£\ Danft fffll^tttSfcfeC, h K + 2 -f@<73fT?lj£it#> 

f > g , W X , W 2 , . . . , W K 

w i = 0 (mod p) 

(m^&;t*u£, *>e>^>sw i ©fee>^>5is^sp^jjsr-ej >5o ) Da ni^ 

f F p = I (mod p ) 
f F a = ] (mod q) 



(25) 2000-516733 (P2000-516733A) 

g G p = I (mod p ) 

g G q = I (mod q ) 
±5tT\ I teMXMflfcBiJfT#|-C&So — Jttfc^ -tbSrHfT-t-S©tt^-e*>l9, 
(BT?>d^a*Tl 0(7)^^#^b^V^-^T^, Da ntefrLV^ f ifcfjg^ 

D a nO^HHiite, ^T©*{*{-J;oT^:^$^SK#lcDtT^J (h x , h 2> . .. 

, h K ) colfet^-efcSo 

hi=F Q w.iG q (mod q) (i=l, 2 , . . . , K) 
(w^p teteb-tZHu k&mX'h&Z ti^M^tlt^\ ) Dan©fffli 

t&4o<Dftm (f, g, Fp, gj -efeSo J^i'J^ji-s f ^^t^g^^-^^ffl^ 

^b*t"Si^5I^S>5t>0^iK^-t-5o ^1r — v^mte, p -tzem^-f 

Ca thytt, e^O^iSrSKLfc^, SkTOlfflUz. «fcoTflF-lHfc* y-fe — 
e= 0 ihi+ 0 2 h 2 +. . . + 0 Kh K +m(mod q) 

a = f e g (m o d q ) 

Danfc£ % ii^if*5 9, - q / 2 L q / 2 (-ffc;b*> % foS«) 0 



(26) 882000-5 1 67 33 (P 2 000-5 1 6 7 3 3 A) 

a= ^ 1W1+0 2 w 2 +. . . 0 K w K +fmg 
±iU^ q^^-r^m^fcltT(i^<^^^(c:^S- tX&Z> 0 ) Dan 

So 

b = a (m o d p ) 
w^t^x^tlr p T'litS r i SWT', ^*U2 S KTO^^M 

b = fmg (mod p) 

F P b G p (mod p ) 

Lfc^ox, N^@t^ ivt-^ft (-tt£t>h, n=m 2 ) ?t 
?mm&m\iL, n^tiMo (n) ^w^^^^i: u ar^t^o (n s/ 

(N 2 ) ffi^^^^^^i U tii-^o (N 2 ) io^r^M^iu R 
SA«^fi^tt, ^{bi^LO (N 3 ) mo^zrv^&^t L^dO ( 
N 3 ) ^CD^^^^-^ 

2 N&^M^^-rs^Li^ir^ y x^c7)[^]±Tfe5 0 



(27) 2000-516733 (P2000-516733A) 

(t.1tnfe&W}%:m eet-in-the - m i d d 1 e) 7 # y 9 

fd + K-l\ (dtK-1)! 
k K-l J = d!(K-l)! 

#lO^*^^'-rSo Lfrfot, 7ct *_k£K = 1 5*3«tU«d = 1 0 2 4 ^il*R L 
4MH»1f >f XttKM 2 1 o g 2 ( g ) t* 5/ h -X? V) % *Jg«if>f x« 2 M 2 1 o 

g2 (pq) try h-c*>S„ ^Hbli*d^^t^XTfc5o 

tSit^So ^^-^J-Cii, ^°nir yif • i/X^J* l 5 5 <ft^— if^^nir 

s/lf • i/7.^rJ» l o 5 ©i-fiM©^ — ^SriUfg-t-S^^^sfct) , 

■fe ylf • v'^v^A 15 5 CO^.— If ^7°nt ylf • i/^^A 15 0 Oa— tf^-^gfl 

s/^r 2 2 cm, mm<^^ ^^-^mmco^mm^mmLxw-^:^ y±— 



(28) ftm. 2000-5 1 6 733 (P2 000-5 1 6 7 3 3A) 

flfff^ + 0 (Hi) fc^LTiSH&Stb*, 

^jT-fi, ^otyf • i/^A i o 5^Btyt 1 1 0%/n^7Af5fe* 
Mn:H^5 0 7-n^ 3 0 5tt, 7 - * N , p, q 

^^^^ JtiB^ffiWMt^ixfcW-CH:, KtelT-fctK M^K)-? 

2 5te&f£Jb&#Jg5£f , glN g2 ... gK (D^^-r o #J£jifc£;U;£, 

1-V\tttl?ti, y~u*y? i 3 O&XXfil 8 5 T~Jg^£*LTV^ 0 

h = g (mod q) 



(29) ($82000-5 1 6733 (P 2 OO 0-5 1 6 7 3 3 A) 

^X^^mmhCOfiW-^^i-o [K> 1 <£>it-£\ i=l, 2,...,K|;o^T^ 

5 5 (Ell) ro/o-feyfi 6 0*ifro7 s Dir S /tlr7 ( o^7^t5^-f 
, B20^b 2 4 0 Idiot- JKH 

Oh 7^»0«^5(7'P^4 3O) O [K>1©!^ KflS 
'WifM^^i, 0 2,... ) 0x«$n5 () ] ^<D#^« N ltffj£<Z> £ 5 

2fe£-L«,<D^®5£-CJ:< s 7^yi»#tm> tt|©A-K^7^tfc«y7 
5 0)o 

e=p<£*h+m (mod q) 

h 1 +ptf> 2 ~h 2 + +p0 K *h K +m(tnod q)lil&5 0 - (Mft^ik* — v^i, ^^/W 

5 0Sr^LT»»«F#, r^J-Ctt^ta-fejy^ • ^T^l 0 5 CO^x 

B5it 0 2fi^l^p 2 6 0 i:iot*snfc, Bt^-fb^ yfe — 

, q ^^-atP^$^tTV^^ffl«tt^^^ i 9tti$tL?)(yn 5/^ 5 5 0) o 
, 7'n j/^ 5 7 0(i^(7)ttf ^itTl/^o 

a = f * e (m o d q ) 

m ' =F p *a (mo d p) 



(30) ^$2000-5 1 6 733 (P2 000-5 1 6 733A) 

6 l 5teKc7>iiit^*u KSr»^-t-5ri:iij:oTfT5iJ©«C3Js^$tL So ^ 

fc, ^^625ll7y^f, g , Wlf w s ,...,w K ©WRi:, w lf 
w 2 , WK^f^t, p£r&£ LTO b&mx«$>Z> b\r^5mflr kfc£rf 0 Z(D 

o 

©ff*l2S#SELfc^*^ % BUt^^ 6 2 5l:AD 4 if bv^^l f *5 «tu? g as 

^ »T©^#ld«toT*^$nSKfi<©tT^| (h ls h 2 ,...,h K ) oy^h© 

hi=F Q WiG a (mod q) (i = 1, 2, . . . , K) 

^y^eeo-ci^T^Sipic, #JB*ttfT*l (f., g , f p , g p ) a 

So 

1"5 J^CL^nir^lf- • WAl 5 5 ([Hi) ©^ntj/fi 6 
«til,BlT*>So ^F^-fb^tLS^ 7t-^A^]$tL(7'D 7 2 0), 

«K^S«$Jx5(^ny^ 7 3 0) o C ih,b©SHifcfcfcSU»3S£gft 1 8 



(31) ft«2 O 0 0-5 1 6 7 3 3 (P2 000-516733A) 

5 ((Hi) fc:J:oT»ft-f * 5 0 &^T\ n^it* yt — *J e 

e= <^> ihi+ 0 2 h 2 + - • • + 0 khk + m(mod q) 

0) o 

n, p. q k&^tt&wztix^^wmmmmmym&ti&^v 8 5 o 

a = f e g (m o d q ) 
a(i x ftSWi^i, p^iLTbill^)^5(/Dy^ 8 8 0) o 

b = a (m o d p ) 

m ' =F p b G p (m o d p) 

NTRU : SR^«-^^^Pt^>^xA 
JEFFREY HOFFSTEIN, JILL PIPHER, JOSEPH H. SILVERMAN 
mm NTRU, t-^fe^^^glfliPt-^V^xAJCOV^Tlft^i-So NTR 



(32) ^$2000-51 6733 (P2 O 00-5 1 6 7 3 3 A) 

0. teD&M 

1. NTRU7;^'!jXA©iP^ 
3. t*a!)7^»tf 

5. NTRU©lS4t^ a yr^ .^7^-^ 
6 . ftilOPKC S t COit^l 

§ o. fi Cfeic: 

D i f f efciVHe 1 1 ma n [4] ^\ ¥<D £ 5 fc-ttbt£l Jjfaffi&frfe 

RS Att % 1 9 7 S^JCR ivest, Shamir, Adel ma n iot 
ffr£$*i,*:t>©-T?ifc!J [10]. ^#^MH|[^t5C tdSffljlTfcSr £ 
{-*<5<„ l©^TAt(i, ^«9ttJE^-^-{c:^#-r-5Mc E 1 i e c e 

[9] ts fe*&mmm<7>m&ic&-5< G o 1 d r e i c h. go i d Wa s 

ser.Halevi [ 5 ] (DMciSKD is*?- A3S-££;h,5 0 



(33) SS2000-5 1 6 733 ( P 2 O O O - 5 1 6 7 3 3 A ) 

ffiv^^ h/W-CI4*<) ffifttfv^^ K/wSrAoJtSr. £j&sffljn?fo5£i 
] ti4 2o©±g«;^145, III:, i^MMMttS^ri^ 

„ e ^ — s^&jt LTDonCopper smithy Johan Has tad 
, Ad i Shamir 3>bHV ^fc&&<D = ^ > h [3] ^O^m 

NTRUIt [1] *5«fcTJ! [6] ^iE*$tbfej: 5 |:I$!gfi/77A©- 

4**3j:"CJ f JB5#Sr#Rg$ix^V^S % NTRUT11 * $ N(7}^ y-fe— ♦ :/n 
y^Sr^^*fc^-^-rsO{^S*SI3i^o (N 2 ) ffl-C*>«9, RSAT^ 
Sir^HSO (N 3 ) fioSHLJ: 9 t^UUl^fcsr ft*: v\, £ 

bfc, NTRuiiftfio (n) -efcOx [9, 5] & zm<D r^3Sj ^w«-e^ 
mttsnzo (n 2 ) tifticiizn^-rsc 

§1 NTRU7^yXA©RK 

§1.1 mmm 

NTRUPgrf^T^ij:, 4 0^7^-^ (N, K, p, q) <t , Sifc 
MMtSN - 1 ^|S©3o©|^L g , L «, , L ro (-^#i-^) 0 ^R=Z 
[X] / (X N -1) %®.m-tZ>o SSfSFeRSr^SASfcli^ W>£LT* 



(34) ^2 000-5 1 6 7 33 (P2 000-5 1.6 733A) 

F = |F i x Ni =[F 1 ,F 2) ...,F N ] 

H - = 2 F ' G ^ + 2 F f G ^-i= Tf^cd^^, f® g =h 

*>U NTRUia^JlS^MA F£G© 

£ U % & £ W L . b fc as T . F<aG©*HM*#flrfcKjSTfc<& c 

TO (Nl ogN) ^^^#T'«F®G^thg:bfc^*tj*c^-e^^ o 
§ 1 . 2 

F, © fs 1 (mod q) i5 «£ Of F p ® f = 1 ( mod p) (i) 
hi= F q ® gi (mod q) l^i^K (2) 

(hi, h 2 , . . . , h K ) 



(35) ft« 2000-516733 (P2 000-516733A) 

D a n Of ffl«|±^-©^S f t fc5o fcfc.U mma-i. Da nteF^fcfS 
§1. 3 #-JMt 

Cathy m-^-M'J) a n tS^S^fc 

t5o &l-> Cathy liKi©#^0 1( . . . , 0 K G L 0 ^«}«L, 
• D a ncD^H (h, h 

K 

e = ^p<t>, ® h s + m (mod q) 

Cathy tf*D a n (JLj@tflli~S!WP#fl:pt y± — ^t?*>S 0 

§1.4 m^- 

Dan^Cathy^W yiz — ^ e £gfg LT*5 9 , g ^cDfJEil f 

a nttfcl. l«S-eKWU^t^S:FSr*ffiri-W-J|tLT33<'<#-e*>5o 

a=f ®e (mod q) 

r <£>i§3\ D a n 14- q / 2 /^V^ L q / 2 ©nil? a 5 0 
Dante, a Srtft«ft*tt5#5St^LT, &.T<D&M.&?f 5 £ t «fc 

F p <g) a (mod p) 

-fc^* U £ ttffcSo ^(Om^, Dante, fr-rfaizgtzz 

/2 + x^^tq/2 + xTa = f®e (mod a) 



(36) SS2000-5 1 6733 (P 2 000-5 1 6 7 3 3 A) 

§1. 5 *^a-g-*s«tgi-5^ 

Dan j&SfHf Lfc^Sit a tt^T©»^SrSlfc-r o 

E 

a=f® e = gf ©p^®^ + f ®m(mod q) 

K 

= gf ©pitiOF,®^ +f ®m(modq) (2)ck0 

K 

s g p4>. ®g. + f ® m (mod q) (1) K) 



2Jp<fc®gi +f ®m 
Z[X]/(X N -1) l:*^Ta = | rt @ gl + {® m 

DttttlT a tfifttS t, ^Jl^f®m (mod 
p) dS^^t,^ F P tJ;5SfjaoT^-7t-ym (mo dp) tmV&t. 

§ 2 a°7^- ?(DWn 
§ 2. i 36IS*5J;ayywA#^ 



SS2000-516733 (P2O00-516733A) 




( * ic, i f i 2 /VNttF©ff*©a(jffl^-p*5.) 



§2. 2 f-^^U^Rfl 

L e = (g6R : gtt- (r-l) (r-1) /2©#Mf§) 
L#=UER: 1 LV ^ d , - 1 t£*g£ d fa<D&%i%:^ 

L m = {me R : mtt- (s-l) fcV^L (s-l) /20#f^ff5] 





c 2 >0dS*>«9 % L 




(38) i*2000-51 6733 (P2000-516733A) 

g G L B & cfc m e L m & L 2 y )V A I g I 2 = VN(r 2 -l)m* «k | 

m I 2 = Vn(s 2 -d/12 5- *T4:ti:tft.3ftft^. «Es«at: 
d -N / 4 & jg T 3 i: ^ *g T <E» . s-V6p^!J?$n 

o 

§ 2 . 3 m-^mrn 

§ 1 . BTflULtijt, I 2 p * s ®g , + f & m i ^ < a T & 

Da nttm^ yt-t?mmt5Ci:iS-e§5 0 -LfBOiiufi©* 
(3) »LT (K <Z)f^c;fc> <9 {C1K+ l £ £ LT+$H£/h$Jfc<ff& 

Jpt ® gj + f 0m ^Jjp^ -| gi | 2 + |f| 2 -H 2 

-c 2 L g (KpL + +L m ) 
- c 2 pL g L, (K + 1) (L m - pL,t Ufe) 

c 2 p L B L «, (K+ 1 ) < q ( 4 ) 



• V 

(39) ft* 2000-51 6733 (P2 OO 0-5 1 6 7 3 3 A) 

§3 ±*=l Vy-jftffi 
§ 3 . 1 Meet — in — the — mi dd 1 e7^^^ 

1 T 3b 0 . L # o T , ^ ^ ft * y iz - s? fl* e = <*> ®!h + m (mo 

d q ) t LTS^H5 ^COir^^i-^o Andrew Odlyzkoll * 
S-*t £ b(D-?% 5 m eet-in-the— midd 1 e T * «y * 

o fSB^^s^Lfi, f £ f = 

f . g , <A SrStR L/iltW^b^^o 
§3.2 #*^{f T $ 
■^teym.W&ffimz-tZtifr^ K=l^£i~5 0 Cathy^ iC^I 

7.?>>*Be t tyll / t-^O^^^T"t 5 i ^tl5 0 
fSf¥(-W^«\ Cathy 

e , = 4> , ®h + m (mod q) ( i = 1 . 2 r ) ££HIT3 

£ 5£ L £ *g £ , Be t t y li ( e , - e t ) ® h ~ 1 (mod 
q) Srfr^U ^titiot^-^! (mod q) Irff^tS r i^f#5 0 
L/!pU 0©#ttt»/J^Vv©t% Be t t y tt0 i-0 !(Z)^^r|f^L, r. 

) "Vfo?>tiki£~eh* Be t t ytt, brute force ilio T"f"^T<7) rJ 
L<fcl\, Be t ty^|-(D^ 7 t-^:©J;9i:|ft5fA T .^ - ^ 



(40) ^2000-5 1 6 733 (P2 OO 0-5 1 6 7 3 3 A) 



§3. 3 ^-^(DJ^y^ 

T^ztK nma-i, M(DikKfr±z^m&. ^tn^-^mxh^> 0 schno 

r r [11, 12] te£n^<Dmz£^XM*te&$k%MtSntLL e n s t r a 
-Lens t r a-Lova s z [8] ©LLLT/l'^y X^T^. ^^^]B#^ 
T-M^/h-<^ hA^JLo^S^ ^7U<D^:t^ {fzt^^ ^10 0) fcl^T 

(HO fcV^TV^cD^^M-Ctt, M^/J^ifn • h^<Z>ft£a (M) 



(h 3 ) (h 2 ) (7)Mffc5itet5 0 ^sraactitti 






• •• • • 

I 

(41) 1IS2000-5 1 6733 (P2000-516733A) 

I v I ^K dim<M> | W | 
1& m& _(H a ) &£Xfi (H s ) l^ttS^SH^kfi, 0£»*S«fctfij£&(;L 

tU±, [5] fciBttSfrbfcPKCSfcJ: «9MlLT:fc9, PKC S^t^a y f 

iiLTVN^o ^7Ei<^^#^ (^10 0) ^ffl^fc^iaoT, K=l. 5 
iyioo *&im-?% Z r £aSfc>3>oT^S„ (fc^tf, [1 1] j3«tUt [1 2] 

Sr#RS$nfev\ ) HS&^^JitfJJiotLT, RSA PKCST^J/j;» 

^{i^5^ttfig^V^^V\ 7 0 0 £ 15 &*£#&7G©te^K:o^T«:iKffc 

(H 2 ) *5it^ (H 3 ) S:<5^i-S^tT-«tV\ ^(D X o ^Md<yt<D^X'^ M 
□ l^otiiS c h n o r r <DZf 



ooo^o^Tisi (h s ) &£xf (h 3 ) -r^trntit-m 

§3. 3. 1 $1 f l^tS/J^7^ 
h i h;®f (mod q) fe /.h £ V* £: l> 5 4$f£ *f "T £ 

/hS*-** h/W<S:#!m-r5o ^H&fTpKW:, h i= [hi!,..., h ±N ] tu 



(42) ^2000-5 1 6733 (P2 000-5 1 6 7 3 3 A) 



M = 



/ X 


0 


... o 


0 


o • 


.. 


0 


X 


... o 


0 


o • 


•• 0 


0 


0 


k 


0 


o • 


•• 0 




K 


- K 


q 


o • 


• 0 




K 


- K 


0 


q • 


• 0 








0 


o • 


• % 



r ? -y # ^mmit-r & t c k t ? ? # iz x o xm& x $ ^5 0 

dim (M) =2 NfciO'D i s c (M) = 1 N q N ' 
v x are 0= [ X f N , . . . , X f !, gii,..., g iN ] 

V ace V to 

V to 
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ilA. 1#BB) T-&5 0 Lfc^oT, t^^^Sli-^^^^ :Tfc5o 



*©/>$a^i7 h JV'[ f g ' ] e M ii . f ' t h , ® f ' = 
g' (mod q) dMtM£/h£v^v^5Wt*«r^ri-5o Ld>U T * y # asjgTF 

K 

e@f ' = ^P^j ® h j® f'+m®f' (mod q) 



§3. 3. 2 if f^t5M^7^5/^ 

UTft^SrJgfiJci-S^tiS-e^s,, T9yjJi£^ hi,...,h k (lgk^K) £r 





0 


0 


0 • 


- 0\ 




qi 


0 


0 • 


• 0 


h 2 


0 




0 


• 0 




0 


0 


qi • 


• 0 




0 


0 


0 • 


• *\ 



d i m (M) = (k + 1 ) N*5 £UD i s c (M) = X N q kN 

V x«r- e — (A f , g i, g 2 ,..., g k ] 



(44) 2000-516733 (P2000-516733A) 

h-J, =VM 2 + |g.| 2 + -|g k |2 =L g >/x?Tk 

k«l^K-^ M >.@™^Disc(M) 1 ^ M > 

V we 

_ K -(k+DN < (k + 1)N ^i/m-n k/rt4 , n 

V ne 

So 

rexRSft (h 2 ) ©T"cni»©«itt^"efc5o 

q^SK^L,^ (6) 

§3. 3. 3 ^/yT^ifC^^j^y^ 

h , ® F (mod a ) &77'J7Xf HTSCIi, ^ n <b. /h 
G i = h j ®F (mod q) ( j = l , 2,...,K) 



A 

(45) RS2000-5 1 6 7 3 3 (P2 O 00-5 1 6 7 3 3 A) 

i.®G l + 0 2 ®G 2 + ... 4- <*> K ®G K 4- m ®F 

[^cZ)^/h^if n • WW3x<^ f/W tar6 = {If, gl gK ) -e&tK 

Lfc^oT, (H 3 ) i^J:^^5C^^3ii-5 o 

v LI _ L = [IF, G lt G 2 ,...,G K ] t-iSks fci£&&&1'Z>ZL tdSt>^So 

+ *-+|Qk|^k <mb, l i ^7k 

■rSfife^SrWi-5„ «f^ % t^T©f$ UF| 2 , I G x I a, . . . , |G K | 
m&mZX&V, L7c^oT, (IS BO KsZitmhtiZo 

l*F| 2 , I G : | 2 ,..., | GK | 2 ^k (K+1)N L g 
-ft, ^tht (3) &&mLX£kT<?>mm&fT5Zbii-V£Z> 0 

\<t> ,®G,+ <J> 2 ®G 2 + ...+ <f> K ®G K + m®F| ffi 

^c.dtf ,| 2 • + + K | 2 • |G K | 2 + |m| 2 • |F| 2 ) 

= c,L* (|G 1 | 2 +... + |G K | 2 + |F| 3 ) 
^ c,(K + l)L<*> L g K 

W Q ^c a (K+l) L«L s k (K+1>N (7) 

(ztizm^miz. (4) btm-fz>-bftx-%z>) 

§3. 3. 4 i@ — i/^tt-tZ>±t&+T 



J) • 

(46) ft£ 2OO0-516733 (P 2 O 00-5 1 6 7 3 3 A) 



/ XI 


0 


0 


0 


0 


o\ 


0 


XI 


0 


0 - 


•• 0 


0 


0 


0 


XI 


0 - 


0 


0 


0 


0 


0 


XI • 


- 0 


0 


.Phi 


ph. 


ph 3 









d i m (M) = (K+ 1 ) N*d XXfD i s c (M) = l KN q N 

<t> 2, <1>k, e — m] 

p !®h!+p <Z> 2 ®h 2 + ... + p 0 K ®h K + m= c (mod q) 

e-m (mod q) <D&%tfc/h£ < f£\,^<DT~ (8) j&SMV^* h/HC^SpJ 

^oT, g£*n<E>#4£^"<^ h/U [0, 0,...,0, e] {CiftV^^ ^/^ Mf | 

V tar t = [^-0 1, /L 0 2,.-., A. 0 K , ~ Ml] 



(47) 
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|v, arg | 2 -LjKX 2 + p 2 



(£>£>«3>5m<= L„,:io«J;t*fc fE£L« (loV^T | m | 2 =p 



*>5V>«wv^x.^ % ^»ut5f^llii, 7^s/^l^fljtt5o 



q l«K«)g K (K + l)N L ^ |^ p l/(K + l) ^ 



§3. 3. 5 *&T-T^^^ • ^°7^-^$iJ^I^^ 

i~64i^^^s*:S*w^: (4) t*icy^h-rs 0 

c 2 pL,L 6 (K + l) < q (4) 



q Mk " Sk^L,^ (lS^KOiTCJJLT) {6 k ) 








) • . • 
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W,.^ c, (K+l) L<t> L e K < K ^> N ( 7 ) 

#> 6 ^ (Cfb It i: & 5 v n < o^^^^yjltcov ^T^^ 5 0 
£i\ ^H^<^^^^«>!r^^-fe-em^^ii:5o *i\ (4) £ (7) £ 

(K^l)N ^° g f C ^ (10 ) 
log K v ' 

oT, ii^tt^i9/h$^p^514R$tL^o ^^m^M^^^tt, (10) ^ 
(K+l) N^TPS^^-x., Zft<&1&Z-Z>b&£A,}?MM-v%te<ti:Z>~t-ejb 

(4) £ (5) %m&&t>^Z>bfr7&i!)mbtLZ> 0 
c 2 p(K+l)N 

L « > » L * < 1J ) 

^TPSJ:^ l. 5f&*^t2^/ifS:Iftt5i «fci\, 



VN(r 2 -l)/12 £ iHS Tc T . L & ^ o T , (1 1) S£fflbTL B £jgftL 
& » . r = L L . V12/N J Z> Z. t Tf * , C <£> « £r , * gB 
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©»*©afcaill**_5fcfcfc:, »tj Srt»f.5a— If fir <z>ftfc 5 k 

= 1. 3 1/100 tr^L, te0^ 0 7^-^%*>i-^«3e-fSili:^t?#5 0 
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Mt5ri^t^5 0 g cd (f'(i), Pq ) =lt<gmh N^U 

p*3«tU5q ^^i-5#*^P(^OV>T, (Z/NZ) ~*p<DP<D 
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^^bi-5^^^-et, &v^-c\ ^^^(Dn^k&ft&mME =ax+y ( 

Att^B*-C*»S) tLTt<ri:m«^5jftT, McEl iece©^ 
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